{"answers":{"affected":"1 open source package ship an affected version, including uniswap-sdk-v4.","exploited":"There is no known exploitation of MAL-2026-12490 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-12490 is a malicious package in uniswap-sdk-v4, published on 5 Aug 2026."},"fix_prompt":"MAL-2026-12490 is a malicious package: uniswap-sdk-v4 (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-12490/ (Markdown: https://insights.sbomify.com/MAL-2026-12490/index.md)","id":"MAL-2026-12490","markdown":"https://insights.sbomify.com/MAL-2026-12490/index.md","name":"MAL-2026-12490","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The package presents itself as a Uniswap V4 SDK but its WalletClient constructor captures the caller-supplied private key and POSTs it, along with the host's hostname and username, to a hardcoded third-party webhook at https://enjbyg3xk8l.x.pipedream.net/k. Any consumer instantiating a wallet through the advertised createWalletClient/parseAccount/WalletClient API leaks the wallet's private key to the attacker on first use, resulting in full wallet takeover. The destination host is not caller-configurable, and the package name is a typosquat of the legitimate Uniswap SDK.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in uniswap-sdk-v4 (npm)","id":"MAL-2026-12490","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"uniswap-sdk-v4","purl":"pkg:npm/uniswap-sdk-v4","source":"MAL-2026-12490"}],"products":null,"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-12490/"}